Analysis of CCTV digital video recorder hard disk storage system

Qin Zhou, Nigel Poole, Panos Abatis

    Research output: Contribution to journalArticlepeer-review

    12 Citations (Scopus)


    A commercial closed circuit television digital video recorder was investigated to determine if it was possible to extract useful video data from its storage media without access to the manufacturer's application software. After an initial test period the storage disk was removed, imaged and analysed. The file structure of the storage disk was deduced and the features necessary to locate a sequence of video evidence identified.

    The format of video data from the device was considered and shown to be based upon standard compression technologies. The observed format was fully documented to enable further development. With a little extra effort in processing the raw video data it was shown how video sequences could be extracted for use as evidence even in cases where the recording device is no longer functional, the turnkey software not available, or data partly corrupted. With careful application standard media players can be employed to view the resulting video sequences.

    Conclusions are that, while based on proprietary file systems and video formats, data from digital video recorder systems is amenable to analysis using commonly available computer tools. In return for investigative work there is a reasonable probability of being able to recover usable video from systems. There is also scope for the development of more specialised software tools to facilitate this process.
    Original languageEnglish
    Pages (from-to)85-92
    JournalDigital Investigation
    Issue number3-4
    Publication statusPublished - Mar 2009

    Bibliographical note

    The full text of this item is not available from the repository.


    • digital forensics
    • CCTV
    • DVR
    • file systems
    • video formats


    Dive into the research topics of 'Analysis of CCTV digital video recorder hard disk storage system'. Together they form a unique fingerprint.

    Cite this